CVE-2026-84919 Drupal CVE debrief

Who should care

Defenders responsible for systems using PhotoSwipe - Responsive JavaScript Modal Image Gallery, especially those using versions from 0.0.0 to 5.0.9, should assess exposure and consider mitigation strategies.

Why it matters

CVE-2026-84919 is a Cross-site scripting vulnerability in PhotoSwipe - Responsive JavaScript Modal Image Gallery that allows Stored XSS, affecting versions from 0.0.0 to 5.0.9. Defenders should verify exposure, assess impact, and consider upgrading to mitigate the vulnerability.

• Defenders need to verify if their systems are using affected versions of PhotoSwipe - Responsive JavaScript Modal Image Gallery.
• Exposure could lead to Stored XSS attacks if not mitigated.
• Defenders should prioritize upgrading to version 5.0.9 or later to mitigate the vulnerability.

Technical summary

The PhotoSwipe - Responsive JavaScript Modal Image Gallery module for Drupal has a Cross-site scripting vulnerability. This issue allows Stored XSS and affects versions from 0.0.0 to 5.0.9. The vulnerability exists due to improper neutralization of input during web page generation. Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using the affected versions of PhotoSwipe - Responsive JavaScript Modal Image Gallery. Upgrading to version 5.0.9 or later is recommended to mitigate the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using the affected versions of PhotoSwipe - Responsive JavaScript Modal Image Gallery.

Recommended defensive actions

• Verify exposure by checking if the installed version of PhotoSwipe - Responsive JavaScript Modal Image Gallery is 5.0.9 or later.
• Assess the impact of this vulnerability on systems using affected versions.
• Consider upgrading to version 5.0.9 or later to mitigate the vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in versions from 0.0.0 to 5.0.9 of PhotoSwipe - Responsive JavaScript Modal Image Gallery. The vulnerability allows Stored XSS and affects versions from 0.0.0 to 5.0.9. Defenders should verify exposure, assess impact, and consider upgrading to mitigate the vulnerability. The source item and CVE record provide evidence of the vulnerability's existence and its potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.